Free course

API Security Course

Protect APIs with complete inventories, object and function authorization, bounded inputs, abuse controls, verified integrations, and operational testing.

5 modules · 25 lessons · No signup

Prerequisites: Security Fundamentals, HTTP, Web APIs and Web Authentication

~~~

Your progress

of lessons completed.

Course completed.

What you'll learn

Review and secure an invoices API across authorization, resource use, credentials, third-party calls, monitoring, and incident response.

Take this course offline

Subscribe to my newsletter to get every free book and course in PDF and EPUB format.

Get the downloads

Course contents

  1. Map the API

    Inventory assets, actors, versions, contracts, and trust boundaries.

    1. ✓ Identify API assets and actors
    2. ✓ Keep an API inventory
    3. ✓ Define request and response contracts
    4. ✓ Draw API trust boundaries
    5. ✓ Check your understanding: map the api

  2. Authorization

    Protect objects, properties, functions, tenants, and bulk actions.

    1. ✓ Enforce object-level authorization
    2. ✓ Protect object properties
    3. ✓ Enforce function-level authorization
    4. ✓ Isolate tenants and bulk actions
    5. ✓ Check your understanding: authorization

  3. Input and resource controls

    Validate shapes, limit expensive work, protect business flows, and return safe errors.

    1. ✓ Validate every request shape
    2. ✓ Limit resource consumption
    3. ✓ Protect sensitive business flows
    4. ✓ Return safe errors
    5. ✓ Check your understanding: input and resource controls

  4. Credentials and integrations

    Scope credentials, prevent replay, verify webhooks, and distrust upstream data.

    1. ✓ Scope API credentials
    2. ✓ Prevent replay and duplicate work
    3. ✓ Verify webhooks
    4. ✓ Treat third-party API data as untrusted
    5. ✓ Check your understanding: credentials and integrations

  5. Test and operate APIs

    Test authorization, harden configuration, monitor abuse, and retire versions safely.

    1. ✓ Write an API security matrix
    2. ✓ Harden API configuration
    3. ✓ Monitor API abuse
    4. ✓ Retire and respond
    5. ✓ Check your understanding: test and operate apis